[ARFC] Pendle Principal Token Risk Oracle

[LlamaRisk]

Summary

The integration of Pendle within Aave represents a sizeable opportunity, where the goal of becoming the most capital-efficient home for Principal Tokens (PT) must be balanced with technical, economic, and counterparty risks. Here are our priorities as an Aave DAO risk provider:

• Clear separation of critical pricing infrastructure and Risk Functions: Critical pricing infrastructure must operate independently from risk advisory functions—just as risk management is separate from growth strategies. While efficiency and automation are valuable, integrating risk advisory directly into critical pricing infrastructure could compromise the credible neutrality of price data transmission. Historically, Aave has only used pricing directly from Chainlink’s DONs or the asset issuer.

• Balancing capital efficiency, simplicity, and risk: While the dynamic pricing method through @ChaosLabs’ Edge Oracle offers notable capital efficiency, increasing the number of adjustable parameters also demands more rigorous oversight. Our testing indicates that adjusting distinct parameters within the proposed methodology may be necessary for safety during varying market regimes. However, streamlining these parameters can simplify on-chain implementation, boost predictability, and strengthen long-term stability and auditability while delivering enhanced capital efficiency compared to other venues. Moreover, reducing complexity minimizes unnecessary operational and centralization risks.

• Ethena exposure and pre-umbrella deployment: Given that the Pendle protocol currently contains a significant proportion of Ethena assets, and considering our recent cautionary warning on sUSDe market liquidity, adopting a conservative exposure on Aave until Umbrella is activated is imperative. This precaution is especially critical since the intended use case pertains strictly to PT and its underlying assets, designed for leveraged looping.

Given the above, we advocate for a simpler, entirely onchain executable solution: the Exponential Lower Bound (ELB) method. Our preferred solution enhances capital efficiency, especially during the early market phase, while delivering a conservative pricing curve that mitigates overpricing risks. Such risks arise when inflated PT prices distort collateral values and borrowing power, potentially leading to rapid overexposure to a given asset and heightened risks of accruing bad debt. Below is our detailed analysis for stakeholder consideration.

We believe this ARFC vote should allow stakeholders to vote on their preferred pricing method for PT.

Detailed Analysis

In this section, we detail and compare three pricing methodologies for PT tokens—Linear Lower Bound (LLB), Edge Oracle (EO), and Exponential Lower Bound (ELB)—and discuss system safeguards and comparative performance.

1. Linear Lower Bound (LLB) - least capital efficient

We previously recommended using a linear lower bound to price PT tokens on Aave. It is a straightforward approach that some of Aave’s competitors have successfully adopted. This method consistently underpins the Principal Token (PT) price in expectation, even in worst-case scenarios, by considering the maximum expected yield configured in the Pendle pool. The primary advantage of the LLB lies in its simplicity and predictability for borrowers. Additionally, it can be fully implemented onchain, reducing reliance on external components. However, as demonstrated by @ChaosLabs, the LLB decreases capital efficiency, particularly over longer durations or in high APY environments. The analysis provided highlighted extreme scenarios—such as 100% APY—which, while theoretically possible, are typically observed in highly speculative assets that do not align with Aave’s lending market. That being said, it is true that the LLB is less capital-efficient than other pricing methods and that there is room for improvement.

2. Edge Oracle (EO) - Max efficiency but complex and offchain components

The oracle proposed in this ARFC utilizes a TWAP mechanism with an exponential threshold, updating the on-chain price as infrequently as possible. This method outperforms the linear lower bound (LLB) in pricing efficiency. However, infrequent updates and yield volatility may temporarily lead to overpricing of PT. When coupled with high LTV ratios, this overpricing can turn Aave into a repository for PT assets, as users exploit near-100% loan values by purchasing PT tokens, depositing them on Aave, and looping the process. This could result in accrued bad debt and impede profitable liquidations.

@ChaosLabs proposes dynamically adjusting the LTV, Liquidation Threshold (LT), and Liquidation Bonus (LB) to mitigate these risks. Our testing indicates that modifying distinct pricing parameters is likely to be necessary under different market regimes. While this flexibility improves market responsiveness, it also increases complexity, complicating onchain implementation, predictability, stability, and auditability.

Additionally, the offchain implementation of this complex pricing method—relying on an external price oracle managed by a risk provider—raises concerns about centralization and transparency. As @EzR3aL noted, best practice recommends separating the roles of price feed and risk providers to avoid conflicts of interest. Implementing the pricing method on a Decentralized Oracle Network (DON) could enhance decentralization and transparency, though it would add another layer of complexity that must be carefully managed.

3. Exponential Lower Bound (ELB) - Balanced middle ground

Building on @ChaosLabs analysis, we propose an Exponential Lower Bound (ELB) as an alternative that enhances capital efficiency compared to the linear oracle while maintaining simplicity and the possibility of an on-chain implementation. This approach effectively addresses concerns related to centralization while ensuring predictable behavior. As demonstrated by @ChaosLabs, under normal market conditions, the PT price follows an exponential trajectory over time due to the effects of interest compounding. Considering such an exponential trajectory in a worst-case scenario, underpricing the PT until maturity consistently is possible.

Similar to the previously proposed LLB, our ELB is calibrated using the maximum expected yield configured within the Pendle pool. This approach ensures that the PT remains consistently underpriced under normal conditions, guaranteeing the protocol’s safety and borrower stability. Given the expected use case of leveraged looping of PTs with their underlying assets, we believe stability should be prioritized over absolute capital efficiency. Moreover, this method demonstrates superior efficiency over competing approaches.

The ELB presents an optimal balance between capital efficiency, safety, and transparency and a competitive alternative to the linear lower bound from a business standpoint.

Modeling different solutions

We compare the proposed pricing methods by visualizing their performance under different conditions. Our plots include three Edge Oracle curves (using different thresholds), the exponential lower and linear lower bound. To illustrate capital efficiency, we analyze two Pendle-onboarded assets with varying APY levels—PT-weETH (normal APY) and PT-ENA (high APY). This comparison highlights the similarities and differences in PT token pricing through a working example and simulations across different APY levels.

Edge Oracle (EO)

The Edge PT Oracle adjusts prices when the reported lnImpliedRate deviates beyond a predefined threshold combined with TWAP parameters. These settings can be tailored per asset, allowing us to examine their sensitivity and impact on Oracle’s reported price.

Observations:

• Thresholds: Higher thresholds result in fewer updates and greater underpricing. This effect is more noticeable in lower APY tokens like PT-weETH, whereas lower thresholds help capture temporary price fluctuations for volatile assets like PT-ENA.
• TWAP Intervals: Longer TWAP intervals reduce sensitivity to short-term volatility, while shorter intervals (e.g., 0.1 days) enable rapid responses to sharp market changes, as seen with PT-ENA.

Considerations:
To balance update frequency and stability, a 1-day TWAP is preferred. Threshold values should be calibrated individually based on asset-specific risk assessments.

Linear Lower Bound (LLB)

The LLB Linear Discount model employs a single rate parameter. By default, Pendle sets MaxRate to mitigate overpricing risk; using a custom rate may introduce risks, as seen with PT-ENA, although overpricing is minimal with the default value. Therefore, while it was pointed out that baseDiscountPerYear can trade significantly above the market price due to potential downward price volatility, discounting with a MaxRate demonstrates minimal overpricing even in downward pricing shocks. The observed sharp PT-ENA price movements support this example.

Observations:

• The model leads to significant underpricing in the early stages.
• While this may suit certain PT pricing curves, the PT-weETH example indicates that a linear discount may not capture all asset price dynamics. PT-weETH pricing curve follows a steeper logarithmic curve, suggesting an exponential reduction in expected APY over time.
• Due to that, the LLB model fails to fit the PT-weETH curve when using any curve, contrary to PT-ENA, where a 20% rate fits the curve accurately. Such steep pricing curves reflect market consensus misalignment, which may stem from speculative activity, e.g., related to the points programs.

Considerations:

• Stick with the default MaxRate to minimize overpricing, especially for volatile assets.
• Evaluate the suitability of a linear discount on a per-asset basis; if early-stage underpricing is an issue, consider alternative pricing strategies.
• PT pricing movements are very volatile in the early bootstrapping phase of the PT market (10-15 days); markets are expected to be onboarded after the period ends, lowering overpricing risks.

Exponential Lower Bound (ELB)

The ELB Exponential Discount model addresses the early-stage underpricing seen with the linear model by considering yield compounding, which results in an exponential trajectory of the PT price through time. However, careful selection of the MaxRate parameter remains critical.

Combined Comparison

The Edge of the ELB compared to the LLB model is visible. @ChaosLabs’s Edge Oracle tracks the price with much higher accuracy, providing a more responsive and dynamic pricing representation; however, when the threshold is set above 1%, instances of overpricing become apparent.

Over-pricing vs. Under-Pricing

Quantifying the risks is crucial, as overpricing presents far greater dangers than underpricing. When the underlying base asset experiences fluctuations, slight overpricing can rapidly erode the safety parameter buffer, intensifying the risk. Additionally, there is a concern that Aave could be used as an exit venue if the overpricing persists. Overpricing under sharp downward volatility is generally temporary due to inherently higher buying pressure. Therefore, these instances are less likely to generate bad debt for the protocol.

The implications of underpricing depend on the model’s consistency. If the pricing model is static (LLB/ELB), underpricing would be of minimal impact since the temporal evolution of the pricing curve is deterministic and non-decreasing, which lets users set more predictive expectations and safety buffers, only needing to align with the underlying risk of base asset. On the other hand, dynamic pricing models (EO) may underprice assets when the price updates are executed due to downward volatility. These updates are susceptible to cause cascading liquidations. Consequently, users must actively manage their positions to mitigate the risk of such unexpected liquidations.

The extent of overpricing is also critical. If the overpricing exceeds the LT-to-LTV buffer, positions that should become liquidatable will remain unaffected, accruing risk to Aave’s lending market. It is important to compare each proposed pricing method to infer the probability and significance of such risks.

PT-weETH

We begin with an overview of PT-weETH. The overpricing issue observed with the Edge Oracle is largely eliminated only when using very high thresholds (around 10%). This behavior is rational because such high thresholds converge the model’s dynamics to those of the exponential or linear models. In contrast, both the linear and exponential models demonstrate the elimination of overpricing when configured with either more conservative or the default MaxRate values.

Furthermore, the overpricing under @ChaosLabs’ Oracle configuration was notably severe. Similar problematic values were observed for PT-weETH, particularly in the first 15 days. This initial period was marked by heightened volatility during the PT price discovery phase when rapid market deployment was not anticipated. Consequently, while the early overpricing is significant, it is less concerning given its occurrence during a transient and volatile period. In the following calculations, we have ignored the initial 15 days of PT price movements to discount these initial pricing movements.

It can be observed that larger, though contained within a 3% buffer, overpricing was observed with EO model pricing. As for ELB, as discussed before, choosing the MaxRate eliminates overpricing completely.

PT-ENA

Similar findings follow for PT-ENA. Here, we observe more frequent overpricing for all pricing methods but can infer the same relationship between the parameter values and mispricing probability. Nonetheless, in this case, choosing the MaxRate still eliminates most overpricing instances, once again supporting the case of selecting the discount rate conservatively.

Given the less speculative nature of the initial pricing for PT-ENA, the real differences in overpricing between the models can be discerned with greater clarity. The differences between EO and ELB methods are much more critical. It can be observed that the overpricing with the EO model would have reached 19-34%, while the MaxRate choice for ELB constrains the overpricing within a 3% threshold:

While the performance of each model highly depends on the PT asset’s volatile nature, the overall findings demonstrate generally larger risk coverage with the LLB/ELB pricing models. As outlined above, this is made available via the conservative MaxRate parameter.

Problematic Cases

It is important to approach PT markets cautiously, as overpricing remains possible. Typically, point programs and speculative yield opportunities will result in yield volatility. Incorrect parameters set into the Pendle pool by the Pendle team or significant changes in the underlying asset could also result in overpricing.

Consider, for example, the case of PT-weETH-27JUN2024, where the Pendle team incorrectly estimated the maximum expected yield for the asset. Our analysis shows that overpricing would have been reached if the MaxRates configuration in the corresponding pool had been used. This is a strong reminder that careful calibration of the lower bound is essential and that we should not blindly use the MaxRates parameter.

Another instance where overpricing would have ensued is the PT-USD0++-27MAR2025. Due to an unexpected change in the guaranteed redemption price of USD0++ by the Usual team, from 1$ down to 0.87$, significant market disruption occurred on USD0++ and the various DeFi applications that integrated with it. As seen below, this resulted in substantial implied yield volatility and severe asset overpricing. In those situations, we believe a manual intervention is necessary to prevent bad debt from accruing.

Other considerations

Circuit Breaker

The ELB consistently underprices the PT price as long as the implied yield remains below the maximum expected yield configured in the Pendle pool. However, swapping within the Pendle ecosystem becomes impossible once the implied yield exceeds this threshold.

Although trading can still occur through the limit order book, where significant liquidity can be accessed, in cases of sustained out-of-bounds implied rates, it is best to pause the market and wait for Pendle to deploy a new pool with updated parameters. This precautionary measure prevents bad accrual for Aave and ensures that profitable liquidations are always possible.

We, therefore, align with @ChaosLabs’ proposal to implement an off-chain circuit breaker that sets the Loan-to-Value (LTV) ratio to 0% to protect the protocol from bad debt scenarios. Additionally, this mechanism guarantees that liquidations remain profitable at all times, preventing cascading failures in volatile market conditions. A Chainlink’s DON providing such a circuit breaker can be implemented to keep a clean separation of concerns.

Disclaimer

This review was independently prepared by LlamaRisk, a community-led non-profit decentralized organization funded in part by the Aave DAO. LlamaRisk serves as a member of Ethena’s risk committee. LlamaRisk did not receive compensation from the protocol(s) or their affiliated entities for this work.

The information provided should not be construed as legal, financial, tax, or professional advice.